OK, so really quickly, let's talk about cryptography a little bit just for a lot of you guys, you
might be looking into getting like you, S.H., or your security.
Plus, understanding cryptography in a different attacks against it will be very important.
So to sum it up, cryptography, by definition is a science or a study of protecting information, whether
it's in transit or arrest.
And this is typically done by using techniques to render the information unusable to anyone who does
not possess the means to decrypt it.
So in our case, it simply means taking a text like Hello John, and transforming it into something
that's unreadable like this this string right here that I'm not even going to try to read.
And this is just to keep the contents of the message confidential.
And this is achieved using what are called encryption algorithms.
So encryption algorithms are pretty much just mathematical formulas, and they can encrypt and decrypt
data using keys without the key, the message will be forever unreadable for the most part and will
not be able to be decrypted.
And there's two forms of encryption.
There's some magic encryption and there's asymmetric encryption.
So symmetric encryption is when you use the exact same key to encrypt the data in the exact same key
to decrypt it.
So this provides confidentiality, but not but not not repudiation.
And one of the challenges with symmetric encryption is that you have to have some way, some secure
way to transfer the key to whoever the recipient of your data is so that that's where it kind of causes
issues and only it should only be used in certain situations.
Asymmetric encryption, on the other hand, uses one key to encrypt it by encrypt the data and then
another key to decrypt the data.
And typically the recipient of like a message or something, they're there publicly, which is a key
that anyone can get access to, is used to encrypt the data that you know, that they're being sent.
And then their private key is the only key that that can actually decrypt that data.
So really, as long as the private keys is private, you know, no one can read that except for them.
So that's where how asymmetric encryption is useful and very versatile.
So there are some there are things called ciphers and ciphers are the methods by which the data is actually
encrypted.
So there's two different kinds of block ciphers and string ciphers.
So extreme ciphers, bits of data are encrypted as a continuous stream.
So you can just imagine like feeding something into a machine and it goes in one end and it's going
out the other end encrypted.
And this is typically a lot faster than block ciphers.
So for block ciphers, bits of data that are put into blocks.
So, for example, you'll see that some ciphers use, you know, 64 bit blocks and they're encrypted
all at once with a key in an algorithm.
And this causes slower speed for encryption.
But, you know, a little bit more reliable and a little bit more secure in some ways.
So as a result, you know, the cipher is, like I said, are used for specific functions based on how
they work.
So reliability and speed for the most part.
So just to go over quickly, some popular symmetric encryption algorithms that you guys want to be aware
of, the D and three D, which is also called a triple test.
So this is a data standard and it's a block cipher that uses a 56 Beaky and it reserves eight bits for
parity.
So this was the de facto standard, for the most part, more then, as came along, the advanced encryption
standard and is also a block cipher.
And it uses either one hundred twenty bit, one hundred ninety two or two hundred fifty six big keys.
And like I said, it replace deaths and triple this.
And just also for clarity, triple das is just doing the deciphering on data three times as all that
is.
So the next one is going to be to fish the of the popular blog Cypher, and he uses a key size of the
256 bits and then there's blowfish, which is faster block cipher.
It uses a 64 bit block size and a key that ranges from thirty two to four hundred forty eight minutes.
And then news RC, which is reverse cipher.
And this is the block cipher that uses a variable chelate of up to 20 and 40 bits.
And the latest one, which is RC six, uses one hundred twenty eight bit blocks for encryption.
So what I want you guys to get from this is pretty much know these names, know that these are block
ciphers and know, you know, how many bits are used like he was.
OK, that's what you're going to need to know, especially if you're going for these certifications.
So some asymmetric encryption algorithms that are popular, Willhelm and this is pretty much what you
see a lot is a secure key exchange protocol.
And he uses SSL and IPCA encryption actually to Shirkey so the keys can be exchanged in a secure manner.
Elliptical curve crypto system.
Also you'll see in places it uses points.
It's very complicated, very complex is points on an elliptical curve in conjunction with logarithmic
problems for encryption is integers.
So it uses like a lot less processing power than other methods.
So it's very popularly used on mobile devices.
So if you ever see, like, you know, particularly exam's or something and you see something about
encryption for a mobile device, this is probably the answer.
And then there's RSA and this proves that she's strong encryption through the use of, you know, large
prime numbers.
And factoring these numbers creates key sizes of the four thousand ninety six bits.
This is the standard.
Typically when you creped things, you're going to be using RSA like for the most part you can use like
RSA.
Yes.
This is what you're going to be doing.
OK, so now let's go over some hashing algorithms so hashing algorithms can be thought of as forms of
encryption, but you just can't reverse them.
It's a one way transaction.
So as a result, you know, hashes using hashes that you might have heard of a file hash or something.
And this is a good way to ensure that the integrity of files and messages remain intact.
And you typically would use hash tag algorithms to securely transmit things like passwords like you
would never send or store passwords in plain text.
You would you once you hash it and then either store it or send it somewhere, that's what you want
to do.
And if you're going to check that again, it's like another password, like maybe in a form like online,
you would take the hash of whatever for whatever password or submit it, send it over, compare it to
the hash and then see then give like a confirmation of if it's correct, if it's correct, and do whatever
function that form is supposed to do.
That's like the secure way of doing things.
And that's kind of like we're hashing algorithms are mainly used.
So just some specific hashing algorithms that you guys should know of this MI five, this produces a
one hundred twenty bit hash output and is expressed as a thirty two digit hexadecimal number.
There is one which is very popular, very popular to use for most products, like the probably the widest
use.
It produces a one hundred sixty bid value output.
So if you, if you get this sha one hash of, of like a file or something is going to be a one hundred
and sixty bid value and then you shot two and three shots, it holds four separate hash function functions
that could produce outputs of two hundred twenty four, two hundred fifty six, three hundred eighty
four and five hundred four bits just to put it out there to Shazza isn't very isn't as widely used as
one.
So you know, further progressing like progress on this stuff is kind of like slow down a little because
I want to still use a lot in Shazza has a lot of functionality and a lot of potential, but one day
I'll probably be up there and probably the most widely used just because of what it can do in the range
of hashes then it can actually have.
OK, so while hashes are secure, you can't attack them so they're not immune to being attacked at all.
Hashes can't be cracked quote unquote in various ways, including preparing like a discovered hash,
like maybe someone pulls a hash out from a database.
They can compare that hash to the hashes of a list of strings that they have in a file.
And this is achievable pretty easily, pretty quickly with applications like Hash Cat and John and Linux
are you're going to see that.
And then also hash is also vulnerable to what are known as collisions.
And this is when the hash of two separate strings actually are equivalent by some crazy coincidence.
This is a very small chance of this happening, but it is always possible.
So in order to protect hashes, there's an extra measure.
That extra security measure is called a salt.
And you can add this on to a password hash, and this is called sorting a hash.
So this is when you add just extra bits of data, you know, onto a hash to prevent the original hash
from being cracked.
And if further reduces the chance that the plaintext version of whatever that original, you know,
whatever the original plaintext string was, it's going to prevent it from being uncovered.
So sorting hashes is very common nowadays, but sorting hashes doesn't always solve the issue, because
if I had if assault is detected, these applications like John and Hash Cat can actually figure out
what the source is and still be able to correct hash.
So that's something that, you know, to keep in mind when you're thinking about attacking.
Cryptography is not extremely practical and it's not something that, you know, we're going to be able
to do here.
And that's something that's actually commonly done.
There's a few ways that it can be hacked, though.
So we're going to go over those.
So there's three ways right now.
Of course, there's a couple other ones.
But the three main ways are going to be a known plaintext attack, a ciphertext only attack and a replay
attack where the replay attack is probably going to be the most effective one for you.
So the no plain text attack is when the attacker has both ciphertext and a plain text and uses uses
both in to kind of figure out how it was encrypted, that it would analyze and see what's going on and
try to see, hey, maybe this was the key that was used in this data.
Now I can use that key, you know, to, you know, send out specific messages or something like that.
I'm going to personally somebody or gain access to different data that's being sent across the network
between like two to something on the side only attack where the hacker has like multiple messages that
are encrypted, like in the same exact way.
And then it would do a statistical analysis on it and figure out, you know, exactly how they were
encrypted.
So this was probably a little bit more difficult versus the first one.
And it's in even both.
It is a very kind of impractical to do for the most part and then is a replay.
It's like this is your best bet as an ethical hacker.
This is typically done with like a man in the middle of attack where the attacker would you be.
You you sit in between two computers or two or something like that, and you capture a cryptographic
exchange and then you repeat it, you know, in hopes of gaining access to whatever, you know, the
host is trying to, you know, gain access to.
And, you know, this is typically is not to affect them when session.
So I use.
But there are ways and still session to still like people's sessions and cookies and such, which we're
going to go over.
We're also going to go over a method of actually being able to spoof someone and downgrade like it would
typically be a GPS.
If they visit a site, we can actually make them we can actually spoof them and make them think that
they're still visiting a cyber really they're visiting our machine.
And then that way they're not using https.
So that's that's kind of a way to be cryptography as well.
So that's a little bit of cryptography.
Just to teach you guys just a little bit, help you get ready for your exams that you're probably going
to take.
And also to give you an idea of how you can actually take, you know, take on cryptography in somewhat
of a way to give you an idea.
So typically, like I said, man in the middle of tech is going to be your bread and butter.
And we're going to kind of do a man in the middle attack here.